EUVD-2026-84167Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:L
AV:N via sync channel and UI:N (background sync); AC:H and the shared-sync-write precondition; PR:N since no privilege on the victim client is required; I:H arbitrary file overwrite, A:L, C:L minor.
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
Lifecycle Timeline
5DescriptionCVE.org
Joplin is an open source note-taking and to-do application that organises notes and lists into notebooks. Prior to 3.6.15 and 3.7.2, Joplin accepts synchronized resource metadata whose id or file_extension contains parent-directory or path-separator characters. BaseItem.unserialize() stores the unvalidated fields, resourceFilename() concatenates them into a destination path, and ResourceFetcher writes the attacker-controlled resource blob outside the resource directory during background synchronization. An attacker with write access to a configured sync target or shared notebook can create or overwrite files at an attacker-chosen existing path without user interaction. This issue is fixed in versions 3.6.15 and 3.7.2.
AnalysisAI
Path traversal in Joplin's sync resource handling lets an attacker who can write to a synchronized target (a shared notebook or a compromised/shared sync backend) plant a resource item with a malformed id or file_extension, causing the client to write the attacker-controlled blob outside the resource directory at an attacker-chosen existing path. Affected clients are Joplin versions before 3.6.15 and 3.7.2; exploitation occurs during routine background synchronization, with no user interaction, and integrity impact is high while confidentiality and availability impacts are low. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires the attacker to have write access to a sync target the victim's Joplin client synchronizes from - either a shared notebook the attacker participates in, or a shared/compromised sync backend (Joplin Server, Nextcloud/WebDAV, S3, filesystem sync). … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine but conditionally-gated integrity issue rather than a mass-exploitation priority. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Upgrade Joplin to 3.6.15 or 3.7.2 (vendor-released patch: 3.6.15 and 3.7.2), which validate resource ids against the 32-character hex format and reject file_extension values containing '/', '\' or '..' during deserialization, with an additional single-path-component check in resourceFilename(); see advisory GHSA-r24r-gp6h-cwgf and pull requests 15540 and 15672. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Joplin installations across the estate and confirm which devices sync to shared notebooks or third-party/shared sync backends, then warn affected users to avoid adding untrusted collaborators to synced notebooks; because no vendor-released patch is identified at time of analysis, confirm the current release state directly with the vendor and treat versions 3.6.15 and 3.7.2 as the referenced remediation thresholds to move toward once a build is obtainable. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into
Joplin is a free, open source note taking and to-do application. Rated critical severity (CVSS 9.6), this vulnerability
Joplin is a free, open source note taking and to-do application. Rated critical severity (CVSS 9.6), this vulnerability
Joplin v2.8.8 allows attackers to execute arbitrary commands via a crafted payload injected into the Node titles. Rated
Joplin Server instances prior to 3.7.2 expose an SSO login-code redemption endpoint (GET /api/login_with_code/:id) that
Joplin is an open source, privacy-focused note taking app with sync capabilities for Windows, macOS, Linux, Android and
Joplin version 2.8.8 allows an external attacker to execute arbitrary commands remotely on any client that opens a link
Joplin is a free, open source note taking and to-do application, which can handle a large number of notes organised into
Joplin 1.2.6 for Desktop allows XSS via a LINK element in a note. Rated medium severity (CVSS 6.1), this vulnerability i
An XSS issue in Joplin desktop 1.0.190 to 1.0.245 allows arbitrary code execution via a malicious HTML embed tag. Rated
Joplin version prior to 1.0.90 contains a XSS evolving into code execution due to enabled nodeIntegration for that parti
Joplin through 1.0.184 allows Arbitrary File Read via XSS. Rated medium severity (CVSS 5.4), this vulnerability is remot
Same weakness CWE-20 – Improper Input Validation
View allSame technique Path Traversal
View allShare
External POC / Exploit Code
Leaving vuln.today